Message Retention doesnt delete old Index

Graylog Central (peer support)
1

Hello,

I configured Index rotation like this:

Create new Index every 12 hours
Keep 365
Delete Index

I can see, that the latest indexes are rotated at 00:00 and 12:00. But my last index has data before the point in time 6 months ago.

I just updated to the latest version, but it didnt help.

kind regards
Philipp

2

Maybe some messages contained a timestamp from the past or the timestamp wasn’t parsed correctly.

Messages are written into Elasticsearch on ingest time, no matter what their “timestamp” is.